-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-parent | maven | <= 19.0.2 | 20.0.2 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from two flaws: 1) Reuse of root session IDs across authentication attempts (CWE-488), and 2) Lack of root session validation during refresh token issuance (CWE-304). The first function likely handles root session ID generation without proper uniqueness guarantees. The second function processes refresh tokens without verifying if the root session belongs to the current user, enabling session takeover. These align with the described attack vector where logout without cookie clearance leads to session ID reuse and invalid token validation.
Ongoing coverage of React2Shell